[drknowhow]

C3 Desk reads its Locks, Permissions, Rules, Built-in guards, Sessions and Now views from the Hub on loopback. A phone can't reach the Hub, so c3-mobile couldn't show any of them. This adds them to the Oracle's mobile gateway as API version 7.

Shared read models. services/fleet_overview.py builds the cross-project payloads. The Hub's /api/hub/locks/overview, /access/overview, /enforcement/overview, /overrides/policy/overview and GET /access/builtin now call it (their responses are unchanged, and the 88 Hub route tests pass as before), so Desk and the phone read the same rows.

New gateway routes (oracle/services/mobile_fleet.py):

Route	Notes
GET /api/mobile/locks/overview	read only; force-release stays on the Hub
GET /api/mobile/access/overview	writable names the scopes this gateway edits
GET /api/mobile/enforcement/overview	global never writable here
GET /api/mobile/overrides/policy/overview	global read-only
POST /api/mobile/enforcement/clear	project scope; confirm: "off" when it would inherit off
POST /api/mobile/overrides/policy/clear	project scope; confirm: "widen" when it loosens
GET /api/mobile/access/builtin	guards, per-project modes, leases
POST /api/mobile/access/builtin/mode	tightens only; looser is 403 needs_desk for every token kind
POST /api/mobile/access/builtin/lease/revoke	ends a lease early; leases are never minted here
GET /api/mobile/sessions/overview, /sessions, /sessions/detail, POST /sessions/mark	no transcript text unless mobile_sessions_transcripts is on; no resume, the claude.ai/code link is passed through
GET /api/mobile/now	live sessions from MCP heartbeats, newest token totals, last C3 call, running jobs, last CI, map freshness, Hub reachability

New capabilities: locks_overview, access_overview, enforcement_overview, enforcement_clear, override_policy_overview, override_policy_clear, builtin, builtin_tighten, sessions, sessions_write, now. New switches: mobile_builtin_enabled, mobile_builtin_tighten, mobile_sessions_enabled, mobile_sessions_write (on) and mobile_sessions_transcripts (off).

Invariant 2 changes on purpose. It used to say no gateway route mentions builtin. It now says no route can loosen or disable a built-in guard. test_mobile_security_api.py pins the exact three builtin routes, and mobile_fleet may not reference mint.

Tests. tests/test_mobile_fleet.py adds 31 tests: switches and capabilities, registered-project filtering, tighten-only builtins (Desk token included), typed words on clear, transcript withholding, heartbeat liveness, and newest-not-summed tokens. Full suite locally: 4,899 passed, 8 skipped. One failure, test_enforcement_flip::test_multiedit_is_blocked, was a 10 s hook-subprocess timeout under -n auto and passes on its own.

https://claude.ai/code/session_01HoyUtV4U8rmvyMqDPQdhxT

[groyep]

Gro could not finish this review.